3 l�_�6�@s�ddlmZmZmZddlZddlmZmZddlm Z ddl mZmZm Z mZmZmZddlmZddlmZddlmZmZmZmZmZmZmZd d �Zdd�Zd d�Zdd�Z dd�Z!ej"e�Gdd�de#��Z$ej"e�Gdd�de#��Z%dS)�)�absolute_import�division�print_functionN)�utils�x509)�UnsupportedAlgorithm)�_CRL_ENTRY_REASON_CODE_TO_ENUM�_asn1_integer_to_int�_asn1_string_to_bytes�_decode_x509_name�_obj2txt�_parse_asn1_generalized_time)�_Certificate)� serialization)�OCSPCertStatus�OCSPRequest�OCSPResponse�OCSPResponseStatus�_CERT_STATUS_TO_ENUM� _OIDS_TO_HASH�_RESPONSE_STATUS_TO_ENUMcstj��fdd��}|S)Ncs(|jtjkrtd��n�|f|��SdS)NzCOCSP response status is not successful so the property has no value)�response_statusr� SUCCESSFUL� ValueError)�self�args)�func��/usr/lib64/python3.6/ocsp.py�wrapper!sz._requires_successful_response..wrapper)� functools�wraps)rrr)rr�_requires_successful_response s r"cCs^|jjd�}|jj|jj|jj||jj|�}|j|dk�|j|d|jjk�t||d�S)NzASN1_OCTET_STRING **�r)�_ffi�new�_lib�OCSP_id_get0_info�NULL�openssl_assertr )�backend�cert_idZkey_hash�resrrr�_issuer_key_hash.sr-cCs^|jjd�}|jj||jj|jj|jj|�}|j|dk�|j|d|jjk�t||d�S)NzASN1_OCTET_STRING **r#r)r$r%r&r'r(r)r )r*r+Z name_hashr,rrr�_issuer_name_hash<sr.cCs^|jjd�}|jj|jj|jj|jj||�}|j|dk�|j|d|jjk�t||d�S)NzASN1_INTEGER **r#r)r$r%r&r'r(r)r )r*r+�numr,rrr�_serial_numberJsr0cCs�|jjd�}|jj|jj||jj|jj|�}|j|dk�|j|d|jjk�t||d�}yt|Stk r�t dj |��YnXdS)NzASN1_OBJECT **r#rz*Signature algorithm OID: {} not recognized)r$r%r&r'r(r)rr�KeyErrorr�format)r*r+Zasn1objr,�oidrrr�_hash_algorithmTsr4c@sbeZdZdd�Zejd�Zeedd��Z eedd��Z eedd ��Zeed d��Zeedd ��Z eedd��Zeedd��Zdd�Zeedd��Zeedd��Zeedd��Zeedd��Zeedd��Zeedd��Zeed d!��Zeed"d#��Zeed$d%��Zeed&d'��Zejed(d)��Zejed*d+��Zd,d-�Zd.S)/� _OCSPResponsecCs||_||_|jjj|j�}|jj|tk�t||_|jtjkr�|jjj |j�}|jj||jj jk�|jj j||jjj �|_|jjj|j�}|dkr�tdj|��|jjj|jd�|_|jj|j|jj jk�|jjj|j�|_|jj|j|jj jk�dS)Nr#zhOCSP response contains more than one SINGLERESP structure, which this library does not support. {} foundr)�_backend�_ocsp_responser&ZOCSP_response_statusr)r�_statusrrZOCSP_response_get1_basicr$r(�gcZOCSP_BASICRESP_free�_basicZOCSP_resp_countrr2ZOCSP_resp_get0�_singleZOCSP_SINGLERESP_get0_id�_cert_id)rr*Z ocsp_response�statusZbasicZnum_resprrr�__init__js. z_OCSPResponse.__init__r8cCs>|jjj|j�}|jj||jjjk�t|j|j�}t j |�S)N)r6r&ZOCSP_resp_get0_tbs_sigalgr:r)r$r(r� algorithmrZObjectIdentifier)rZalgr3rrr�signature_algorithm_oid�sz%_OCSPResponse.signature_algorithm_oidcCs8|j}y tj|Stk r2tdj|��YnXdS)Nz)Signature algorithm OID:{} not recognized)r@rZ_SIG_OIDS_TO_HASHr1rr2)rr3rrr�signature_hash_algorithm�s z&_OCSPResponse.signature_hash_algorithmcCs2|jjj|j�}|jj||jjjk�t|j|�S)N)r6r&ZOCSP_resp_get0_signaturer:r)r$r(r )rZsigrrr� signature�sz_OCSPResponse.signaturecs��jjj�j�}�jj|�jjjk��jjjd�}�jjj||�}�jj|d�jjjk��jjj |�fdd��}�jj|dk��jjj |d|�dd�S)Nzunsigned char **rcs�jjj|d�S)Nr)r6r&ZOPENSSL_free)Zpointer)rrr��sz2_OCSPResponse.tbs_response_bytes..)r6r&ZOCSP_resp_get0_respdatar:r)r$r(r%Zi2d_OCSP_RESPDATAr9�buffer)rZrespdataZppr,r)rr�tbs_response_bytes�sz _OCSPResponse.tbs_response_bytescCsz|jjj|j�}|jjj|�}g}xRt|�D]F}|jjj||�}|jj||jjj k�t |j|�}||_|j|�q,W|S)N) r6r&ZOCSP_resp_get0_certsr:Zsk_X509_num�rangeZ sk_X509_valuer)r$r(rZ _ocsp_resp�append)rZsk_x509r/Zcerts�irZcertrrr�certificates�sz_OCSPResponse.certificatescCs.|j�\}}||jjjkrdSt|j|�SdS)N)�_responder_key_namer6r$r(r )r�_�asn1_stringrrr�responder_key_hash�sz _OCSPResponse.responder_key_hashcCs.|j�\}}||jjjkrdSt|j|�SdS)N)rJr6r$r(r)r� x509_namerKrrr�responder_name�sz_OCSPResponse.responder_namecCsP|jjjd�}|jjjd�}|jjj|j||�}|jj|dk�|d|dfS)NzASN1_OCTET_STRING **zX509_NAME **r#r)r6r$r%r&ZOCSP_resp_get0_idr:r))rrLrNr,rrrrJ�sz!_OCSPResponse._responder_key_namecCs|jjj|j�}t|j|�S)N)r6r&ZOCSP_resp_get0_produced_atr:r )r�produced_atrrrrP�sz_OCSPResponse.produced_atcCsH|jjj|j|jjj|jjj|jjj|jjj�}|jj|tk�t|S)N)r6r&�OCSP_single_get0_statusr;r$r(r)r)rr=rrr�certificate_status�sz _OCSPResponse.certificate_statuscCsr|jtjk rdS|jjjd�}|jjj|j|jjj ||jjj |jjj �|jj |d|jjj k�t|j|d�S)NzASN1_GENERALIZEDTIME **r)rRr�REVOKEDr6r$r%r&rQr;r(r)r )r� asn1_timerrr�revocation_time�sz_OCSPResponse.revocation_timecCs||jtjk rdS|jjjd�}|jjj|j||jjj |jjj |jjj �|ddkrXdS|jj |dtk�t|dSdS)Nzint *rr#��)rRrrSr6r$r%r&rQr;r(r)r)rZ reason_ptrrrr�revocation_reasonsz_OCSPResponse.revocation_reasoncCsb|jjjd�}|jjj|j|jjj|jjj||jjj�|jj|d|jjjk�t|j|d�S)NzASN1_GENERALIZEDTIME **r) r6r$r%r&rQr;r(r)r )rrTrrr�this_updatesz_OCSPResponse.this_updatecCsb|jjjd�}|jjj|j|jjj|jjj|jjj|�|d|jjjkrZt|j|d�SdSdS)NzASN1_GENERALIZEDTIME **r)r6r$r%r&rQr;r(r )rrTrrr�next_update,sz_OCSPResponse.next_updatecCst|j|j�S)N)r-r6r<)rrrr�issuer_key_hash<sz_OCSPResponse.issuer_key_hashcCst|j|j�S)N)r.r6r<)rrrr�issuer_name_hashAsz_OCSPResponse.issuer_name_hashcCst|j|j�S)N)r4r6r<)rrrr�hash_algorithmFsz_OCSPResponse.hash_algorithmcCst|j|j�S)N)r0r6r<)rrrr� serial_numberKsz_OCSPResponse.serial_numbercCs|jjj|j�S)N)r6Z_ocsp_basicresp_ext_parser�parser:)rrrr� extensionsPsz_OCSPResponse.extensionscCs|jjj|j�S)N)r6Z_ocsp_singleresp_ext_parserr^r;)rrrr�single_extensionsUsz_OCSPResponse.single_extensionscCsL|tjjk rtd��|jj�}|jjj||j�}|jj |dk�|jj |�S)Nz/The only allowed encoding value is Encoding.DERr)r�Encoding�DERrr6�_create_mem_bio_gcr&Zi2d_OCSP_RESPONSE_bior7r)� _read_mem_bio)r�encoding�bior,rrr�public_bytesZs z_OCSPResponse.public_bytesN)�__name__� __module__�__qualname__r>rZread_only_propertyr�propertyr"r@rArBrErIrMrOrJrPrRrUrWrXrYrZr[r\r]�cached_propertyr_r`rgrrrrr5hsT r5c@sZeZdZdd�Zedd��Zedd��Zedd��Zed d ��Ze j dd��Zd d�ZdS)�_OCSPRequestcCs~|jj|�dkrtd��||_||_|jjj|jd�|_|jj|j|jjj k�|jjj |j�|_|jj|j|jjj k�dS)Nr#z+OCSP request contains more than one requestr)r&ZOCSP_request_onereq_count�NotImplementedErrorr6� _ocsp_requestZOCSP_request_onereq_get0Z_requestr)r$r(ZOCSP_onereq_get0_idr<)rr*Zocsp_requestrrrr>hsz_OCSPRequest.__init__cCst|j|j�S)N)r-r6r<)rrrrrZvsz_OCSPRequest.issuer_key_hashcCst|j|j�S)N)r.r6r<)rrrrr[zsz_OCSPRequest.issuer_name_hashcCst|j|j�S)N)r0r6r<)rrrrr]~sz_OCSPRequest.serial_numbercCst|j|j�S)N)r4r6r<)rrrrr\�sz_OCSPRequest.hash_algorithmcCs|jjj|j�S)N)r6Z_ocsp_req_ext_parserr^ro)rrrrr_�sz_OCSPRequest.extensionscCsL|tjjk rtd��|jj�}|jjj||j�}|jj |dk�|jj |�S)Nz/The only allowed encoding value is Encoding.DERr)rrarbrr6rcr&Zi2d_OCSP_REQUEST_bioror)rd)rrerfr,rrrrg�s z_OCSPRequest.public_bytesN) rhrirjr>rkrZr[r]r\rrlr_rgrrrrrmfsrm)&Z __future__rrrr ZcryptographyrrZcryptography.exceptionsrZ0cryptography.hazmat.backends.openssl.decode_asn1rr r rrr Z)cryptography.hazmat.backends.openssl.x509rZcryptography.hazmat.primitivesrZcryptography.x509.ocsprrrrrrrr"r-r.r0r4Zregister_interface�objectr5rmrrrr�s" $ ~